Cannot modify header information - after making no changes?

If you’re on a shared server, any script running on the server, even in other accounts, could lead to this type of compromise. It’s likely that it’s just a script kiddie searching for index.php and index.html files and appending the links, but you might have your host scan for rootkits, etc... let them know what happened. It’s probably also safest to update to the latest version of MODx that was recently patched due to potential for security exploits in certain server configurations.

Thanks for the advice. I’ve contacted my host (no reply as yet), but I hope we’ll be able to work together to improve security. I’ll also update the modx install. I am on a shared server incidentally.

I’m just grateful this happened while the site was still in development, and no actual damage was done!